starred/CIPP

Fork 0

mirror of https://github.com/KelvinTegelaar/CIPP.git synced 2026-04-25 08:16:01 +03:00

[GH-ISSUE #1212] Offboarding Wizard fails if UPN does not match email address #672

New issue

Closed

opened 2026-03-02 12:44:14 +03:00 by kerem · 2 comments

kerem commented

2026-03-02 12:44:14 +03:00

Owner

Originally created by @drew5901 on GitHub (Nov 10, 2022).
Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/1212

Description

Run offboarding wizard
Select tenant, select user, select options, run wizard
Receive error that "An error has occurred: Resource '' does not exist or one of its queried reference-property objects are not present" 403 - Request failed with status code 403

This users UPN is not the same as the users email address. The account does sync to O365 from an on-prem AD via AD connect. The only options selected should be able to be managed in O365 without changing anything in Active Directory unless is errors out because "remove from all groups" would include groups from AD.

Environment data

hosted in Azure

Originally created by @drew5901 on GitHub (Nov 10, 2022). Original GitHub issue: https://github.com/KelvinTegelaar/CIPP/issues/1212 ### Description 1) Run offboarding wizard 2) Select tenant, select user, select options, run wizard 3) Receive error that "An error has occurred: Resource '<email address>' does not exist or one of its queried reference-property objects are not present" 403 - Request failed with status code 403 This users UPN is not the same as the users email address. The account does sync to O365 from an on-prem AD via AD connect. The only options selected should be able to be managed in O365 without changing anything in Active Directory unless is errors out because "remove from all groups" would include groups from AD. ### Environment data ```PowerShell hosted in Azure ```

kerem

2026-03-02 12:44:14 +03:00

closed this issue
added the
bug

unconfirmed-by-user
labels

kerem commented

2026-03-02 12:44:15 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Nov 10, 2022):

Thank you for creating a bug. Please make sure your bug is indeed a unique case by checking current and past issues, and reading the complete documentation at https://kelvintegelaar.github.io/CIPP
If your bug is a known documentation issue, it will be closed without notice by a contributor. To confirm that this is not a bug found in the documentation, please copy and paste the following comment: "I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.".

Without confirming, your report will be closed in 24 hours. If you'd like this bug to be assigned to you, please comment "I would like to work on this please!".

@github-actions[bot] commented on GitHub (Nov 10, 2022): Thank you for creating a bug. Please make sure your bug is indeed a unique case by checking current and past issues, and reading the complete documentation at https://kelvintegelaar.github.io/CIPP If your bug is a known documentation issue, it will be closed without notice by a contributor. To confirm that this is not a bug found in the documentation, please copy and paste the following comment: "I confirm that I have checked the documentation thoroughly and believe this to be an actual bug.". Without confirming, your report will be closed in 24 hours. If you'd like this bug to be assigned to you, please comment "I would like to work on this please!".

kerem commented

2026-03-02 12:44:15 +03:00

Author

Owner

@KelvinTegelaar commented on GitHub (Nov 11, 2022):

The issue that the users UPN does not match their primary email address is actually an issue for MS's side too; this is an unsupported M365 configuration since recently. If you really want to have unmatching UPNs Microsoft recommends this article to understand all the limitations that you'll have:

https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configuring-alternate-login-id#what-is-alternate-login-id

So to summerize; this is an unsupported/not recommended M365 configuration, and thus not a CIPP issue.

@KelvinTegelaar commented on GitHub (Nov 11, 2022): The issue that the users UPN does not match their primary email address is actually an issue for MS's side too; this is an unsupported M365 configuration since recently. If you really want to have unmatching UPNs Microsoft recommends this article to understand all the limitations that you'll have: https://learn.microsoft.com/en-us/windows-server/identity/ad-fs/operations/configuring-alternate-login-id#what-is-alternate-login-id So to summerize; this is an unsupported/not recommended M365 configuration, and thus not a CIPP issue.

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/CIPP#672

No description provided.

Rows
Columns